Information Commissioner’s Office 
Internal Audit Report: Core Financial Controls 
November 2021 


mazars 


Contents 


01 Introduction 1 
02 Background 1 
03 Key Findings 1 
3.1 Examples of areas where controls are operating reliably 4 
3.2 Risk Management 5 
3.3 Value for Money 5 
3.4 Sector Comparison 5 
04 Areas for Further Improvement and Action Plan 6 
A1 Audit Information 12 


Disclaimer 


This report (“Report”) was prepared by Mazars LLP at the request of the Information Commissioners Office (ICO) and terms for the preparation and scope of the Report have been agreed with them. 
The matters raised in this Report are only those which came to our attention during our internal audit work. Whilst every care has been taken to ensure that the information provided in this Report is 
as accurate as possible, Internal Audit have only been able to base findings on the information and documentation provided and consequently no complete guarantee can be given that this Report is 
necessarily a comprehensive statement of all the weaknesses that exist, or of all the improvements that may be required. 


The Report was prepared solely for the use and benefit the ICO and to the fullest extent permitted by law Mazars LLP accepts no responsibility and disclaims all liability to any third party who 
purports to use or rely for any reason whatsoever on the Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification. Accordingly, any reliance placed on the 
Report, its contents, conclusions, any extract, reinterpretation, amendment and/or modification by any third party is entirely at their own risk. Please refer to the Statement of Responsibility in 
Appendix A1of this report for further information about responsibilities, limitations and confidentiality. 
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01 Introduction 


As part of the agreed Internal Audit Plan for 2021/22, we have undertaken 
a review of the Information Commissioner’s Office (ICO) Core Financial 
Controls. It is vital that financial controls are reviewed on a regular basis, 
with our last review taking place in September 2019 that provided the ICO 
with adequate assurance. 


We have reviewed key controls to assess whether the ICO’s framework 
and processes are designed and operating effectively. This included the 
following risk areas: 


Financial regulations; 
Purchases; 

Control Account Reconciliations; 
Trade receivables; 

Suspense accounts; 

Journals; 

Dent write offs; and 

Monitoring and reporting; 


Full details of the risks covered are included in Appendix A1. 


We are grateful to the Interim Director of Finance, Head of Finance, Group 
Finance Manager, Management Accountant, and other staff for their 
assistance during the audit. 


The fieldwork for this audit was completed remotely. We have been able to 
obtain all relevant documentation and/or review evidence via screen 
sharing functionality to enable us to complete the work. 


This report summarises the results of the internal audit work and, 
therefore, does not include all matters that came to our attention during the 
audit. Any such matters have been discussed with the relevant staff. 


02 Background 


Due to continued growth at the ICO, and increased demand in relation to 
operational delivery, it is essential that key financial controls operate 
effectively and that key internal controls and processes are not 
overlooked. There have been changes within the finance function in 2021, 
with a new Director of Finance and Head of Finance recently joining the 
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team. The finance system used is Microsoft Dynamics, however the ICO 
are currently in the process of procuring a new finance system. 


There is a Finance Manual in place, most recently updated in June 2020, 
which governs key financial processes including (but not limited to): bank 
account payments and reconciliations, purchasing, fixed assets, payroll, 
and financial reporting. The Finance Manual is stored on the staff intranet 
and is accessible to all staff. 


Bank and control account reconciliations are performed on a monthly basis 
by various members within the Finance Team. Each staff member is 
required to evidence completion of the reconciliation, with any variances to 
be investigated, with an explanation provided by the second week of the 
month-end. The reconciliations are then reviewed by the Group Finance 
Manager and initialled as reviewed within the month-end checklist. 


Purchases are authorised in line with the limits set out in the Scheme of 
Delegations, which was most recently updated in October 2021 The 
maximum authority to sign off purchase orders and invoices is contingent 
on staff level, with authorisation limits ranging from to £5,000 to 
£1,000,000 for Directors and Heads of Department, with an unlimited 
amount for the most senior staff, the Head of Finance and Director of 
Finance. In addition to this, there are a small number of staff who are set 
up on the purchasing system to approve purchase orders or invoices, with 
higher limits where their duties require this. 


All staff within the Finance Team can raise manual journals. Once a 
journal is posted, supporting documentation is either attached to the 
journal within Microsoft Dynamics or saved on the management accounts 
folder. It is not possible for journal authorisation to be evidenced on 
Microsoft Dynamics. Only journals over £10k that are end of month 
recodes are authorised. Authorisation is confirmed via email, which is 
saved attached and saved to the journal entry posted. The Group Finance 
Manager performs a monthly review of journal posted and initials this to 
confirm it has been reviewed. 


The ICO has a Bad Debt Policy, which was most recently updated in July 
2020. The Bad Debt Policy details high level procedures to be followed 
when writing off or impairing irrecoverable debts relating to general 
invoices to suppliers, loans made to staff, recovered legal fees, 
Registration Fees confirmed as due and civil and monetary penalties. The 
policy details delegated authority limits for write-off of debts for different 


types of debts, detailing the nominated sign-off officer and area of impact 
on the financial statements. All documentation is required to be retained in 
respect of the current financial year and previous 6 years, with 
documentation retained within finance records when written off. 


As part of the month-end process, ICO produce monthly management 
accounts, which are published on their website. Per ICO’s corporate 
governance structure, financial information is reported to: 


e Management Board, who per the terms of reference, meet at least 
four times annually. This body consists of Executive and Non- 
Executive members. At this body, monthly management accounts 
are presented, as well as other financial information where 
required such as pay data or annual accounts. This body has 
responsibility for ensuring sound financial management and 
scrutinising the allocation of financial resources to ensure strategic 
objectives are achieved. 

e The Senior Leadership Team (SLT), who meet on a quarterly 
basis. This body consists of senior staff and directors. The Senior 
Leadership team may refer matters to the Executive Team where 
escalation or approval is required and minutes of SLT meetings 
are presented to Management Board for information. This 
Executive Team has responsibility for ensuring sound financial 
management and scrutinising the allocation of financial resources 
to ensure strategic objectives are achieved. Financial information 
is reported on a quarterly basis, where information such as the 
position against budget is discussed and scrutinised. This is 
presented by the Director or Resources. 

e The Audit and Risk Committee are required to meet at least 
quarterly per the terms of reference. The Audit and Risk 
Committee supports the Management Board in its role in respect 
of in respect of the effectiveness of the ICO’s risk management 
system and procedures and its internal controls. The most recent 
monthly management accounts are presented to this committee, 
as well as other relevant financial information. 


The Executive team meets on a monthly basis. Whilst there is no specific 
financial information reported to this body per the terms of reference, 
relevant financial matters are considered and scrutinised to ensure 
strategic objectives are achieved. 


mazars 


03 Key Findings 


Assurance on effectiveness of internal controls 


Moderate Assurance 


Rationale 


The internal audit work carried out has provided Moderate Assurance. 
Please see Appendix A1 for the detailed scope and definitions of the 
assurance ratings. 


Our audit has concluded that there is a generally sound control 
framework in place, however our work has identified one significant 
recommendation and six housekeeping recommendation at Section 04. 


Number of recommendations 
Priority 1 Priority 2 Priority 3 Total 
2 1 4 5 


3.1 Examples of areas where controls are operating 
reliably 


e We reviewed Bank Account Reconciliations for the three bank 
accounts for April, July, and September 2021 and found these had 
been completed appropriately, including investigation and 
documentation of any reconciling items. Through testing, we 
confirmed that there had been segregation of duties as these were 
prepared and authorised by a separate individual. The Group 
Finance Manager performed the review of the bank reconciliations. 


e We tested two Control Account reconciliations across three months, 
April, July and September 2021. We confirmed that variances had 
been investigated with appropriate explanations provided. Through 
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testing, we confirmed that there had been segregation of duties as 
these were prepared and authorised by a separate individual. The 
Group Finance Manager performed the review of the control account 
reconciliations. 


e We tested a sample of 25 purchases from the financial year 2021/22 
with a range of values selected from a listing of purchases, with PO 
and Non-PO expenditure selected for testing. From this we verified 
that invoices had been recorded on the finance system accurately by 
agreeing these through to an invoice and that purchases had been 
approved appropriately. We did this by confirming values for PO and 
invoice authorisation were in line with the ICO’s Scheme of 
Delegations for individual staff or in line with limits set up on the 
purchasing system We confirmed that values were appropriate for 
individual staff by obtaining a HR report which detailed staff grades 
and compared this to the Scheme of Delegations and a list of 
approvers from the purchasing system 


e We reviewed the Suspense Account reconciliation for the ICO and 
confirmed that this is monitored and reviewed. The balance as of 
September 2021 was around £4k. We did note a minor point that the 
review was noted dated to determine timeliness and have made a 
recommendation in relation to this (recommendation 4.1). 


e We reviewed the policy for Debt Write-Offs and confirmed that this 
has been updated within the past 18 months, per the 
recommendation raised in the Core Financial Controls review in 
2019/20. The policy includes roles and responsibilities with regards 
to write-offs, authority to write-off debts and retention periods for 
relevant financial records. 


e We sample tested three months of management accounts (April, July 
and August 2021) to ensure that information was complete and 
accurate. We confirmed this by reconciling the income and 
expenditure figures reported to a trial balance report obtained from 
the finance system. However, we noted that on ICO’s website for 
August 2021, the published figures in the management accounts 
were incorrect as the report contained July's figures. We have raised 
a recommendation around this matter (See Recommendation 4.1). 
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e We confirmed that financial reports were presented to the Audit and 
Risk Committee in June and October 2021, to Management Board in 
May, July and October 2021 and to SLT in July 2021. We are 
satisfied that financial reporting is accurate as a result of testing. 


3.2 Risk Management 


Our review of the ICO’s Risk and Opportunity Register reported to Audit 
and Risk Committee in October 2021 acknowledged that the ICO has 
established the following strategic risk of relevance to this audit: 


Risk 3 (R46) — Financial Resilience: “Risk that sensitivities in the income 
growth forecast and new territories of expenditure create inaccurate 
financial forecasting and planning assumptions leading to insufficient 
funding and financial stress impeding the ICO’s ability to meet its 
statutory requirements, and full delivery of all its intended IRSP goals 
and outcomes. 


As a result of strained public finances and the uncertain economic outlook 
resulting from the covid-19 pandemic, there is an increased emphasis in 
the sector on financial management, including accurate and timely 
reporting around forecast and budgets. 


The following mitigating control for this risk has been identified which 
relate to the scope of this review; Monthly accounts to track income and 
expenditure. 


Based on the findings of our review, we were able to confirm that financial 
reports are prepared on a regular basis for senior staff and Board 
members and that the information within the reports is complete and 
accurate. 


3.3 Value for Money 


Value for Money (‘VfM’) is a key priority within governmental organisations, 
as significant scrutiny is placed on the spending of public sector 
organisations. 


Effective and efficient financial management in relation to an organisations 
Core Financial Controls is important in ensuring that there is a robust 
framework of financial controls, but also to meet external reporting and 
regulatory requirements, as well as responsibilities to a range of 
stakeholders. 


VfM implications can arise in the area of core financial controls through 
inefficient processes and working practices. For example, significant 
reliance on manual processes require additional resources to produce 
routine financial information. 


We understand that ICO is currently in the process of procuring a new 
finance system. ICO should ensure that this has key functionalities, 
particularly around producing routine financial reports without requiring 
significant manual intervention outside of the finance system. This will 
ensure that staff time can be allocated efficiently to enable value to be 
added to other areas. 


3.4 Sector Comparison 


Core financial controls is an area that is typically effective across public 
sector organisations, as this area is subject to regular scrutiny and review 
by internal and external auditors. 


Our review identified that in relation to raising and posting journals, there 
are no segregation of duties in place on the current finance system and 
users do not have limits on the value of journals that can be posted nor is 
there a policy which outlines the approval process within the Finance 
Manual. 


Organisations of a similar profile would typically have a Finance Policy or 
set of financial regulations which would govern this process. We note that 
whilst ICO has a Finance Manual in place, this does not include key 
processes around posting journals. We have raised a recommendation 
around this matter, please see Recommendation 4.1. 
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04 Areas for Further Improvement and Action Plan 


Definitions for the levels of assurance and recommendations used within our reports are included in Appendix A1. 


We identified areas where there is scope for improvement in the control environment. The matters arising have been discussed with management, to whom we 
have made recommendations. The recommendations are detailed in the management action plan below. 


Observation/Risk Recommendation Priority | Management response Timescale/ 
responsibility 


Accuracy and Completeness of Information ICO should ensure that Recommendation accepted. Q3 2021.22 - 
Reported management accounts published The August 2021 management Head of 
Observation: We reviewed the income and on their website are reviewed for accounts report has been Finance 
expenditure reported in the monthly management accuracy prior to upload. removed from the ICO website 

accounts on the ICO website and compared this to and a new version with the correct 

information in the trial balance to confirm data has been uploaded. 


information reported is accurate and complete. A new monthly process has been 


We noted that the actual financial values reported put in place to include approval by 
in the August 2021 management accounts were Resource Board with checks from 
incorrect. The values included within the report the Head of Finance and approval 
had not been updated from July 2021, whereas by the Director of Finance prior to 
the narrative to support the values and variances publishing. These reports include: 
had been updated for August 2021. 

- Expenditure transparency 
We noted that the internally reported August 2021 report > £25k 
management accounts were correct. These were - Corporate credit card 
reported to the Audit & Risk Committee in October transaction report > £500 
2021k - Executive team expenses 


- Monthly management 


Risk: If information is reported is inaccurate or 
account report 


incomplete, this could have an adverse impact on 
decision making. 
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Observation/Risk Recommendation Priority | Management response Timescale/ 
responsibility 


Review of Key Account reconciliations and ICO should: Recommendation accepted. Q2 2022.23 — 
End of Month Checklist e Ensure that it can The new Head of Finance and Lg el 
Observation: We noted from reviewing bank demonstrate that all month Director of Finance commenced esa 
reconciliations, key accounts reconciliations, the end reviews are completed over October and November and 
suspense account reconciliation and the end of within an appropriate are carrying out a review of roles, 
month checklist that whilst it was possible to timeframe. responsibilities and processes to 
demonstrate that reviews had taken place, these ° stat po rad ca ensure that these are 
ste a cae manner that segregation of aa strengthened and will ensure that 
performed the review on both these recommendations are 

For example, we noted that: the reconciliations and the picked up as part of this work. 
E ‘ ie i end of month checklist. R ; 

we reviewed (Apri, July, and September * Establish a ist of appropriate al cai odes 

2021), it was not possible to ascertain when individuals to review being developed by nehleau o! 

reviews by the Group Finance Manager had reconciliations or the end of Finance and the Director of 

taken place as these were only initialled. month checklist in instances Finance and will be presented to 
e For the month of September 2021, which was where the required individual Resources Board in Q4 2021/22, 

obtained in October 2021, some sections of is absent or unavailable. with implementation of the 

the review checklist were incomplete. This changes to Finance across Q1 + 

may indicate that not all aspects of review are Q2 of 2022-23. This will likely 

completed within a timely manner (within two make changes to the structure 

pa the beginning of the following and capacity and capability of the 

month). 


team, some of which may be a 
dependency on implementing 
these audit recommendations. 


e The end of month checklist had evidence of 
review by the Group Finance Manager, 
however only one month had been signed off 
by the Head of Finance. Whilst we have been 
made aware that there have been periods 
where there has not been a permanent Head 
of Finance or Director of Finance in post within 
the past 12 months, interim arrangements 
should have been made to ensure this was 


mazars 


Ref | Observation/Risk Recommendation Priority | Management response Timescale/ 
responsibility 


signed off by an appropriately senior 
individual. 


Risk: Errors within control accounts are not 
identified and corrected, which may lead to 
financial irregularities. 


4.3 Authorisation of Journals ICO should: 3 Recommendation accepted. Q2 2022.23 — 
ion: ¡ i i e Agree user limits for posting A further check will continue to eceler 
Observation: Through audit testing, review of ; , Finance 
documents and discussions with staff, we noted manual journals and ensure take place and the process of this 
that the current finance system does not have the that manual journals are check will be documented. 
functionality for journals to be approved within it, appropriately approved The financial procedure manual 
therefore journals are required to be reviewed e Ensure the methodology for will also be updated to reflect the 
manually. The only journals that are reviewed are the approval of manual new ways of working. 
manual journals, and of these, only end of month journals is practical to the 
recodes above £10,000 are reviewed. ICO and update the Finance 
Procedure Manual to reflect 
We also noted that journals are reviewed on a this. 


monthly basis by the Group Finance Manager. A 
spreadsheet is produced and the Group Finance 
Manager dates and initials the spreadsheet to 
demonstrate that this has been reviewed. 
However, there is no further documentation of the 
review on the spreadsheet. 


We note that this method is not consistent with the 
Finance Procedure Manual. The Manual states 
that any journal above an individuals user limit 
should be approved prior to posting. 


Risk: Errors within manual journals are not 
identified and corrected, which may lead to 
financial irregularities. 
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Observation/Risk Recommendation Priority | Management response Timescale/ 
responsibility 


Proactive review of Access Rights 


Observation: Through discussions with 
management we understand that a regular review 
of finance system access rights is not performed. 
A regular review would provide assurance that 
current access rights to finance systems are 
appropriate to individuals job roles. 


Risk: Individuals access rights may not be aligned 
to their job role creating either inefficiencies or 
inappropriate access. 


4.5 Review of Aged Debtor balances 


Observation: We reviewed debtor balances as of 
September 2021. Disregarding the fine debtors 
(covered as part of the Fines Recovery audit), the 
balance included approximately: 


e £40k of legal fees; and 
e £8k of other receivables. 


Our review identified that the majority of the 
balances were over 6 months old, with one legal 
fee balance dating back to 2013. 


Given the low value and age of some of the items 
on the debtors balance and debt collection trends, 
it would appear that some of these debts are 
unlikely to be recoverable. 


Risk: If receivables remain in the sales ledger 
when they are unlikely to be recovered, this 
creates the risk the sales ledger may not 
accurately reflect the current financial position. 
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ICO should: 


Recommendation accepted. Q2 2022 — 
Head of 
Ensure that a review of The Head of Finance will carry out _. 
A ; Finance 
access rights to the a full review of access rights for 
finance system occurs on the various financial systems. A 
a sufficiently regular regular review will be conducted 
basis, in line with best on a quarterly basis to give 
practice recognised at assurance the appropriate access 
other organisations of a rights are maintained. 
similar profile. 
ICO should: 3 Recommendation accepted. Q2 2022 — 
Perform a housekeeping A review will be undertaken to eee ot 
; : Finance 
exercise and review the identify debtor balances not 
balances for other included in the Financial 
debtors and legal fees on Recovery remit. 
the sales ledger and ; 
: These balances are reviewed on 
consider whether these : E 
an annual basis. We will 
amounts are recoverable : 
E strengthen our documentation 
or need to be written off. ; 
around these reviews to create a 
more robust audit trail. 


A1 Audit Information 


Audit Control Schedule 


Chris Braithwaite, Senior Corporate 
Governance Manager 


Caroline Robinson, Corporate Governance 
Officer 


Client contacts: Louise Byers, Interim Director of Finance 
Gurj Kang, Interim Head of Finance 


lan Greatorex, Group Group Finance 
Manager 


Diane Rutkowski, Management Accountant 


Peter Cudlip, Partner 
Internal Audit Team: Darren Jones, Manager 
Stuart Richardson, Senior Auditor 


Finish on site/ Exit 


meeting: 8 November 2021 


Last information 


received: 16 November 2021 


Draft report issued: 22 November 2021 


Management responses 


received: 29 November 2021 


Final report issued: 9 December 2021 
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Scope and Objectives 


Audit objective: To provide assurance that ICO has effective key 
financial controls. Our review considered the following risks: 


e Financial Regulations — The ICO do not have a set of financial 
regulations in place that provides appropriate controls of ICO finances. 
These are not reviewed at an appropriate level 

e Purchases — Procurement of goods and services are not managed in 
line with the Financial Regulations that includes a scheme of 
delegation for the authorisation of expenditure Goods are services are 
procured without the necessary authorisation and oversight 

e Control account reconciliations — Key control accounts are not 
adequately reconciled and reviewed on a timely basis 

e Trade receivables — Debtors are not invoiced correctly or on a timely 
basis. Aged debts are not proactively followed up and recovered 
correctly or written off. (Note: this will exclude fines recovery as we 
have carried out a separate audit on this area in 2021/22). 

e Suspense accounts — Suspense accounts are not identified, 
monitored, and cleared on a timely basis 

e Journals- Manual Journals are processed without appropriate 
authorisation or inappropriate/inaccurate journals are posted. 

e Debt write offs — Debt is written off without the appropriate 
authorisation. (Note: this will exclude fines recovery as we have 
carried out a separate audit on this area in 2021/22). 

e Monitoring and reporting — Financial reports are not prepared ona 
regular basis for senior staff and board members. The information 
within the reports is not accurate and complete. 


The scope for the audit is concerned with assessing whether the ICO 
has in place adequate and appropriate policies, procedures and controls 
to manage the above risks. We will review the design of controls in 
place and, where appropriate, undertake audit testing of these to 
confirm compliance with controls, with a view to forming an opinion on 
the design, compliance with and effectiveness of controls. 


Testing will be performed on a sample basis, and as a result our work 
does not provide absolute assurance that material error, loss or fraud 
does not exist. 


Definitions of Assurance Levels 


Level Description 


Substantial 
Assurance: 


The framework of governance, risk management and 
control is adequate and effective. 


Some improvements are required to enhance the 
adequacy and effectiveness of the framework of 
governance, risk management and control. 


Moderate 
Assurance: 


Limited 
Assurance: 


There are significant weaknesses in the framework of 
governance, risk management and control such that it 
could be or could become inadequate and ineffective. 


There are fundamental weaknesses in the framework 
of governance, risk management and control such 
that it is inadequate and ineffective or is likely to fail. 


Definitions of Recommendations 


Unsatisfactory 
Assurance: 


oy) bow 


Remedial action must be 
taken urgently and within 
an agreed timescale. 


Significant weakness in 
governance, risk 
management and control 
that if unresolved 
exposes the organisation 
to an unacceptable level 
of residual risk. 


Priority 1 
(Fundamental) 
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Priority 2 
(Significant) 


Priority 3 
(Housekeeping) 


Recommendations 
represent significant 
control weaknesses 
which expose the 
organisation to a 
moderate degree of 
unnecessary risk. 


Recommendations show 
areas where we have 
highlighted opportunities 
to implement a good or 
better practice, to 
improve efficiency or 
further reduce exposure 
to risk. 


Statement of Responsibility 


Remedial action should 
be taken at the earliest 
opportunity and within an 
agreed timescale. 


Remedial action should 
be prioritised and 
undertaken within an 
agreed timescale. 


We take responsibility to the Information Commissioner’s Office (ICO) 
for this report which is prepared based on the limitations set out below. 


The responsibility for designing and maintaining a sound system of 
internal control and the prevention and detection of fraud and other 
irregularities rests with management, with internal audit providing a 
service to management to enable them to achieve this 

objective. Specifically, we assess the adequacy and effectiveness of 
the system of internal control arrangements implemented by 
management and perform sample testing on those controls in the 
period under review with a view to providing an opinion on the extent to 
which risks in this area are managed. 


We plan our work in order to ensure that we have a reasonable 
expectation of detecting significant control weaknesses. However, our 
procedures alone should not be relied upon to identify all strengths and 
weaknesses in internal controls, nor relied upon to identify any 
circumstances of fraud or irregularity. Even sound systems of internal 
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control can only provide reasonable and not absolute assurance and 
may not be proof against collusive fraud. 


The matters raised in this report are only those which came to our 
attention during our work and are not necessarily a comprehensive 
statement of all the weaknesses that exist or all improvements that 
might be made. Recommendations for improvements should be 
assessed by you for their full impact before they are implemented. The 
performance of our work is not and should not be taken as a substitute 
for management’s responsibilities for the application of sound 
management practices. 


This report is confidential and must not be disclosed to any third party 
or reproduced in whole or in part without our prior written consent. To 
the fullest extent permitted by law Mazars LLP accepts no 
responsibility and disclaims all liability to any third party who purports 
to use or rely for any reason whatsoever on the Report, its contents, 
conclusions, any extract, reinterpretation amendment and/or 
modification by any third party is entirely at their own risk. 
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Contacts 


Peter Cudlip 
Partner, Mazars 
peter.cudlip@mazars.co.uk 


Darren Jones 
Manager, Mazars 
darren.jones@mazars.co.uk 


Mazars is an internationally integrated partnership, specialising in audit, accountancy, advisory, tax and legal services*. Operating in over 90 countries and 
territories around the world, we draw on the expertise of 40,400 professionals — 24,400 in Mazars’ integrated partnership and 16,000 via the Mazars North 
America Alliance — to assist clients of all sizes at every stage in their development. 


*where permitted under applicable country laws. 


www.mazars.co.uk 
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